Compare commits

..

No commits in common. "master" and "v1.0.12-alpha" have entirely different histories.

5 changed files with 109 additions and 65 deletions

View file

@ -2,40 +2,28 @@
![](docs/_assets/images/favpng_parrot-royalty-free-cartoon.png) ![](docs/_assets/images/favpng_parrot-royalty-free-cartoon.png)
**NOTE**: httpaste is publicly hosted at [httpaste.it](http://httpaste.it) and as a hidden Tor service ([https://paste77ubkwxy4fqezffsmthxdh3xerwi72tlsw2mch7ecjhw2xn7iyd.onion](https://paste77ubkwxy4fqezffsmthxdh3xerwi72tlsw2mch7ecjhw2xn7iyd.onion)). httpaste is a pastebin application for easily pasting and retrieving data over
Both services are to be considered evaluatory, as long as the source code HTTP from shell environments and web browsers. It is inspired by [sprunge.us](http://sprunge.us)
is in pre-release. Regarding voidance of pre-release status, see [Open Issues](https://victorykit.atlassian.net/issues/?jql=project%20%3D%20HTTPASTE%20AND%20fixVersion%20in%20(1.1.0-beta%2C%201.2.0-beta%2C%201.3.0)), for more information. and [ix.io](http://ix.io/), but focuses on extendability, advanced security, with little to
no trade-off to simplicity. It can be hosted through WSGI, CGI, Fast CGI, or
as a standalone evaluation server. It offers multiple storage backends, such as
a filesystem backend, SQLite backend, MySQL backend, or MongoDB backend.
This program offers an HTTP interface for storing public and private data All pastes are being encrypted on the fly and can only be retrieved by an
(a.k.a. pastes), commonly referred to as a pastebin application. It is inspired by [sprunge.us](http://sprunge.us) and [ix.io](http://ix.io/). It can be hosted through WSGI, CGI, Fast authorized user, either through knowing the paste id of a public paste, or
CGI, or as a standalone evaluation server. It offers multiple storage backends, having authentication credentials, as well as the paste id of a private paste.
such as a filesystem backend, SQLite backend, or MySQL backend. This makes httpaste ideal as a pastebin for sensitive environments such as the
Tor network. Authentication credentials are created on-the-fly and dont require a sign-up process.
Public data can be accessed through an URL, where as private pastes httpaste supports output formatting for syntax highlighting (powered by
additionally require HTTP basic authentication. Creation of authentication
credentials happens on the fly, there is no sign-up process. Public pastes can
only be accessed by knowing their paste ids, they are not listed on any index,
since it isnt technically possible (by design).
All pastes are symetrically encrypted server-side with an HMAC derived key and
SHA-256 hashing, a server-side salt and a randomly generated password. Public
pastes passwords are derived from their ids. Private pastes passwords are
randomly generated and stored inside a symetrically encrypted personal
database, with the encryption key also being derived through the same HMAC
mechanism, where the HTTP basic authentication credentials act as the master
password.
Paste ids, usernames, and any other identifiable attributes are only stored
inside storage backends as keyed and salted BLAKE2 hashes.
The program supports output formatting for syntax highlighting (powered by
[pygments](https://pygments.org/)), as well as MIME type output manipulation, and input encoding. [pygments](https://pygments.org/)), as well as MIME type output manipulation, and input encoding.
The program can therefore serve as a minimalist, anonymous object storage for Therefore httpaste can server as an anonymous object storage for small data.
small data.
Minute-based and burn-after-read paste expiration are also supported. Minute-based and burn-after-read paste expiration are supported.
# Getting Started httpaste focuses on security through cryptography, making it a computationally intensive application.
# Get Started
## Install ## Install

View file

@ -9,41 +9,28 @@ httpaste - versatile HTTP pastebin
.. image:: _assets/images/favpng_parrot-royalty-free-cartoon.png .. image:: _assets/images/favpng_parrot-royalty-free-cartoon.png
.. note:: httpaste is a pastebin application for easily pasting and retrieving data over
httpaste is publicly hosted at `httpaste.it`_ and as a hidden Tor service (`<https://paste77ubkwxy4fqezffsmthxdh3xerwi72tlsw2mch7ecjhw2xn7iyd.onion>`_). HTTP from shell environments and web browsers. It is inspired by `sprunge.us`_
Both services are to be considered evaluatory, as long as the source code and `ix.io`_, but focuses on extendability, advanced security, with little to
is in pre-release. Regarding voidance of pre-release status, see `Open Issues`_, for more information. no trade-off to simplicity. It can be hosted through WSGI, CGI, Fast CGI, or
as a standalone evaluation server. It offers multiple storage backends, such as
a filesystem backend, SQLite backend, MySQL backend, or MongoDB backend.
This program offers an HTTP interface for storing public and private data All pastes are being encrypted on the fly and can only be retrieved by an
(a.k.a. pastes), commonly referred to as a pastebin application. It is inspired by `sprunge.us`_ and `ix.io`_. It can be hosted through WSGI, CGI, Fast authorized user, either through knowing the paste id of a public paste, or
CGI, or as a standalone evaluation server. It offers multiple storage backends, having authentication credentials, as well as the paste id of a private paste.
such as a filesystem backend, SQLite backend, or MySQL backend. This makes httpaste ideal as a pastebin for sensitive environments such as the
Tor network. Authentication credentials are created on-the-fly and don't require a sign-up process.
Public data can be accessed through an URL, where as private pastes httpaste supports output formatting for syntax highlighting (powered by
additionally require HTTP basic authentication. Creation of authentication
credentials happens on the fly, there is no sign-up process. Public pastes can
only be accessed by knowing their paste ids, they are not listed on any index,
since it isn't technically possible (by design).
All pastes are symetrically encrypted server-side with an HMAC derived key and
SHA-256 hashing, a server-side salt and a randomly generated password. Public
paste's passwords are derived from their ids. Private paste's passwords are
randomly generated and stored inside a symetrically encrypted personal
database, with the encryption key also being derived through the same HMAC
mechanism, where the HTTP basic authentication credentials act as the master
password.
Paste ids, usernames, and any other identifiable attributes are only stored
inside storage backends as keyed and salted BLAKE2 hashes.
The program supports output formatting for syntax highlighting (powered by
`pygments`_), as well as MIME type output manipulation, and input encoding. `pygments`_), as well as MIME type output manipulation, and input encoding.
The program can therefore serve as a minimalist, anonymous object storage for Therefore httpaste can server as an anonymous object storage for small data.
small data.
Minute-based and 'burn-after-read' paste expiration are also supported. Minute-based and 'burn-after-read' paste expiration are supported.
.. include:: guide/getting-started.rst httpaste focuses on security through cryptography, making it a computationally intensive application.
.. include:: guide/get-started.rst
Documentation Documentation
------------- -------------
@ -83,7 +70,3 @@ This program uses licensed third-party software.
.. _sprunge.us: http://sprunge.us .. _sprunge.us: http://sprunge.us
.. _pygments: https://pygments.org/ .. _pygments: https://pygments.org/
.. _icon: https://favpng.com/png_view/parrot-parrot-royalty-free-cartoon-png/gps7HM42 .. _icon: https://favpng.com/png_view/parrot-parrot-royalty-free-cartoon-png/gps7HM42
.. _Open Issues: https://victorykit.atlassian.net/issues/?jql=project%20%3D%20HTTPASTE%20AND%20fixVersion%20in%20(1.1.0-beta%2C%201.2.0-beta%2C%201.3.0)
.. _httpaste.it: http://httpaste.it

View file

@ -0,0 +1,70 @@
Get Started
===========
Install
"""""""
.. code-block:: shell
$ python3 -m pip install httpaste-victorykit
$ httpaste --help
Create Configuration
""""""""""""""""""""
.. code-block:: shell
$ httpaste default-config --dump myconfig.ini
.. note::
The default configuration creates an in-memory SQLite backend, which is not
suitable for WWW deployments. Visit `backend`, for more
information on configuring the backend.
Run a Local Evaluation Server
"""""""""""""""""""""""""""""
.. code-block:: shell
$ httpaste standalone --config myconfig.ini --port 8080
Publish a Private Paste
"""""""""""""""""""""""
.. code-block:: shell
$ echo 'My first private paste' | curl -F 'data=<-' -u myusername:mypassword http://localhost:8080/paste/private
http://localhost:8080/paste/private/UALUA9
.. note::
If the user does not exist, they will be created upon authentication.
Retrieve a Private Paste
""""""""""""""""""""""""
.. code-block:: shell
$ curl -u myusername:mypassword http://localhost:8080/paste/private/UALUA9
My first private paste
Publish a Public Paste
""""""""""""""""""""""
.. code-block:: shell
$ echo 'My first public paste' | curl -F 'data=<-' http://localhost:8080/paste/public
http://localhost:8080/paste/public/X4L39J
Retrieve a Public Paste
""""""""""""""""""""""""
.. code-block:: shell
$ curl http://localhost:8080/paste/public/X4L39J
My first public paste

View file

@ -9,6 +9,9 @@ Install
$ python3 -m pip install httpaste-victorykit $ python3 -m pip install httpaste-victorykit
$ httpaste --help $ httpaste --help
.. note::
httpaste is publicly available at `https://httpaste.it`_, and can be accessed
over the TOR network via `https://pastefao6mwyafs3cznoe2u2a6iizw5laulrznla3dytcnvaizte73yd.onion`_ aswell. Both are hosted on different servers of different service providers.
Create Configuration Create Configuration
"""""""""""""""""""" """"""""""""""""""""

View file

@ -4,7 +4,7 @@
:maxdepth: 1 :maxdepth: 1
:caption: Guides :caption: Guides
guide/getting-started guide/get-started
guide/advanced-usage guide/advanced-usage
guide/backend guide/backend
guide/cli guide/cli